mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-16 05:20:22 +08:00
John T. Myers
dbba580e84
Refresh the CI image tool pins so Go-built tools are rebuilt with patched Go releases and move the sandbox Python runtime to 3.14.5. Rebase the gateway runtime to a pinned distroless Debian 13 image with glibc 2.41-12+deb13u3 while preserving the existing UID/GID 1000 runtime identity for upgrade compatibility. Update rustls-webpki to 0.103.13 and clarify Linux k3d guidance now that k3d is not installed through mise on Linux. Signed-off-by: John Myers <9696606+johntmyers@users.noreply.github.com>
37 lines
1.3 KiB
Docker
37 lines
1.3 KiB
Docker
# syntax=docker/dockerfile:1.4
|
|
|
|
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Gateway image build.
|
|
#
|
|
# The Rust binary is built natively before this image build runs and staged at:
|
|
# deploy/docker/.build/prebuilt-binaries/<arch>/openshell-gateway
|
|
#
|
|
# Use tasks/scripts/docker-build-image.sh gateway (or `mise run build:docker:gateway`)
|
|
# to stage the binary and build the image in one step. CI builds the binary
|
|
# per-architecture via the `rust-native-build.yml` workflow and uploads it as
|
|
# an artifact, which is downloaded into the same staging directory before the
|
|
# image build job runs.
|
|
#
|
|
# The runtime is distroless Debian 13, which provides glibc and the dynamic
|
|
# loader needed by the GNU-linked gateway binary while keeping the attack
|
|
# surface small. The default digest currently carries Debian glibc
|
|
# 2.41-12+deb13u3.
|
|
|
|
ARG GATEWAY_BASE_IMAGE=gcr.io/distroless/cc-debian13:nonroot@sha256:e1fd250ce83d94603e9887ec991156a6c26905a6b0001039b7a43699018c0733
|
|
|
|
FROM ${GATEWAY_BASE_IMAGE} AS gateway
|
|
|
|
ARG TARGETARCH
|
|
|
|
WORKDIR /app
|
|
|
|
COPY deploy/docker/.build/prebuilt-binaries/${TARGETARCH}/openshell-gateway /usr/local/bin/openshell-gateway
|
|
|
|
USER 1000:1000
|
|
EXPOSE 8080
|
|
|
|
ENTRYPOINT ["/usr/local/bin/openshell-gateway"]
|
|
CMD ["--bind-address", "0.0.0.0", "--port", "8080"]
|